curl / Docs / curl CVEs / Authorization: Negotiate sent to foreign origin
Related:
Audits
Changelog
curl CVEs
JSON metadata
Original report
Vulnerability Disclosure
Vulnerabilities Table

CVE-2026-94265

Authorization: Negotiate sent to foreign origin

Project curl Security Advisory, October 14 2026 Permalink

VULNERABILITY

When processing an HTTP redirect to a URL containing userinfo (a username:password component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl to send a freshly minted Kerberos ticket—generated using the ambient identity of the client process to an untrusted third-party host, effectively bypassing the domain-scoping restrictions normally enforced by the absence of --location-trusted.

INFO

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-94265 to this issue.

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Severity: low

This bug is not considered a C mistake (likely to have been avoided had we not been using C).

AFFECTED VERSIONS

libcurl is used by many applications, but not always advertised as such!

This flaw also affects the curl command line tool.

SOLUTION

RECOMMENDATIONS

A - Upgrade curl to version 8.23.0

B - Apply the patch to your local version

C - Do not follow directs when using Negotiate

TIMELINE

This issue was reported to the curl project on September 18, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication of this advisory.

CREDITS

Thanks a lot!